8 ms·

Yeah this is asking for trouble. We only had a small demo on our homepage where users could upload media files and they were deleted after 24 hours and still so

Yeah this is asking for trouble. We only had a small demo on our homepage where users could upload media files and they were deleted after 24 hours and still some people managed to abuse it and nearly got our site killed, domain blacklisted in Google with a big red screen of death. I don't want to spam any links here but if you are interested please do look at my last post about the dangers of doing this and lessons I learned from my mistake. Please do not keep the files for 10 days. Even 24 hours is a deal-breaker. From what I've learned, anything more than 30 minutes can get you into trouble.

dheera 6y ago
I once had a location-based file sharing service that also got blacklisted by Google with no recourse. I hate Google trying to police the internet with no timely appeals process. I wonder though if you could simply just block the Google crawler and bypass it. Or use a JavaScript to auto-POST something before the file gets sent for download. The Google crawler doesn't issue POST requests as far as I know.
- gowld 6y ago
  By "police", do you mean "warn people about dangers" ?
  - dheera 6y ago
    There wasn't any danger. Nothing more than Google Drive or Dropbox. And they didn't have any way to contact them and explain. Way to heavy-handedly shut down a potential business idea.
    - xyzzy_plugh 6y ago
      Drive and Dropbox are at least moderated.
      - planetafro 6y ago
        Source? ...moderated via automation or human?
        CobrastanJorji 6y ago
        https://support.google.com/a/answer/172541?hl=en https://support.google.com/a/answer/172541?hl=en > Google Drive scans a file for viruses before the file is downloaded or shared. If a virus is detected, users cannot convert the infected file to a Google Doc, Sheet, or Slide, and they'll receive a warning if they attempt these operations. So at least some degree of automated moderation is going on. Frankly, I'd be astounded if some amount of scanning isn't being done for illegal content and/or phishing stuff.
        PeterisP 6y ago
        Automation; the bare minimum would be to scan for known child sexual abuse material hashes - if you're not doing that, then opening up anonymous uploads is very risky, as for CSAM (unlike most other things) you may be personally liable even if it's distributed there without your knowledge. Cloudfare's CSAM scanning tool is one option that may help, there are other options. You can't rely on the good faith of users, if your service is easily usable for crime, it will be used for it.
        MandieD 6y ago
        "You can't rely on the good faith of users; if your service is easily usable for crime, it will be used for it." - should be on every developer's login screen
        mcculley 6y ago
        And every developer needs to explain this to clients. I had a client wanting to defer identity validation on a two-sided market system. I had to explain how it would be used for money laundering. It had never occurred to the client.
      - 6y ago
  - unglaublich 6y ago
    More like taking suspects into custody.
    - cjohansson 6y ago
      and without responding to questions or providing evidence
Naac 6y ago
Similar sites like http://ix.io/ http://ix.io/ have been up for many years with no issues. I assume spam can be a problem, but these sites must have figured something out.
- Natsu 6y ago
  I suspect spam is on the nicer side of things people might upload... :/
mwambua 6y ago
Can you remedy this problem by making it so that anyone can delete the file? That way anyone can take it down if they have a problem with it? It's supposed to be ephemeral storage anyway... people might not mind having files disappear.
- dspillett 6y ago
  Two problems there: 1. Many people are more likely to go to a lot of effort to complain loudly and widely rather than hit a simple "delete this" link. 2. Such feature is basically a self-DoS. If someone takes a disliking to the app or a user of it they can script up a "delete everything" and fire it off.

dheera 6y ago

I once had a location-based file sharing service that also got blacklisted by Google with no recourse. I hate Google trying to police the internet with no timely appeals process. I wonder though if you could simply just block the Google crawler and bypass it. Or use a JavaScript to auto-POST something before the file gets sent for download. The Google crawler doesn't issue POST requests as far as I know.

gowld 6y ago
By "police", do you mean "warn people about dangers" ?
- dheera 6y ago
  There wasn't any danger. Nothing more than Google Drive or Dropbox. And they didn't have any way to contact them and explain. Way to heavy-handedly shut down a potential business idea.
  - xyzzy_plugh 6y ago
    Drive and Dropbox are at least moderated.
    - planetafro 6y ago
      Source? ...moderated via automation or human?
      - CobrastanJorji 6y ago
        https://support.google.com/a/answer/172541?hl=en https://support.google.com/a/answer/172541?hl=en > Google Drive scans a file for viruses before the file is downloaded or shared. If a virus is detected, users cannot convert the infected file to a Google Doc, Sheet, or Slide, and they'll receive a warning if they attempt these operations. So at least some degree of automated moderation is going on. Frankly, I'd be astounded if some amount of scanning isn't being done for illegal content and/or phishing stuff.
      - PeterisP 6y ago
        Automation; the bare minimum would be to scan for known child sexual abuse material hashes - if you're not doing that, then opening up anonymous uploads is very risky, as for CSAM (unlike most other things) you may be personally liable even if it's distributed there without your knowledge. Cloudfare's CSAM scanning tool is one option that may help, there are other options. You can't rely on the good faith of users, if your service is easily usable for crime, it will be used for it.
        MandieD 6y ago
        "You can't rely on the good faith of users; if your service is easily usable for crime, it will be used for it." - should be on every developer's login screen
        mcculley 6y ago
        And every developer needs to explain this to clients. I had a client wanting to defer identity validation on a two-sided market system. I had to explain how it would be used for money laundering. It had never occurred to the client.
    - 6y ago
- unglaublich 6y ago
  More like taking suspects into custody.
  - cjohansson 6y ago
    and without responding to questions or providing evidence

Naac 6y ago

Similar sites like http://ix.io/ http://ix.io/ have been up for many years with no issues. I assume spam can be a problem, but these sites must have figured something out.

Natsu 6y ago
I suspect spam is on the nicer side of things people might upload... :/

mwambua 6y ago

Can you remedy this problem by making it so that anyone can delete the file? That way anyone can take it down if they have a problem with it? It's supposed to be ephemeral storage anyway... people might not mind having files disappear.

dspillett 6y ago
Two problems there: 1. Many people are more likely to go to a lot of effort to complain loudly and widely rather than hit a simple "delete this" link. 2. Such feature is basically a self-DoS. If someone takes a disliking to the app or a user of it they can script up a "delete everything" and fire it off.